How would a bad actor completely bypass this "firewall/ad blocker"?

How about by simply hard coding an IP address?

How about using coded links to the base server URL?

DNS is not a very effective firewall nor an ad blocker and it certainly isn't magic. Whenever I point this out, the typical response from someone's pi-hole is, "Well, it's better than nothing".